JP2015167295A - System and method for vpn connection - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce work related to VPN connection.SOLUTION: A VPN management server 1 includes: a setting information storage unit 12 which stores first setting information for use when a first communication device 2 is VPN connected to a second communication device 3 and second setting information for use when the second communication device 3 is VPN connected to the first communication device 2; and a setting information transmitter unit 13 which transmits the first setting information to the first communication device 2 and also transmits the second setting information to the second communication device 3. The first communication device 2 includes a first communication unit 23 for VPN connection with the second communication device 3, on the basis of the first setting information received from the VPN management server 1. Also, the second communication device 3 includes a second communication unit 33 for VPN connection with the first communication device 2, on the basis of the second setting information received from the VPN management server 1.

Description

  The present invention relates to a VPN connection system and a VPN connection method.

  Conventionally, a VPN (Virtual Private Network) is used as a method for a user who is located away from an office via a communication network to connect to the office network. For example, in order for a user working from home to connect to the office network from home, a VPN connection device for performing VPN connection is installed at home, and various settings for VPN connection are performed on the device. There is a need. For example, Patent Document 1 discloses that a user inputs setting information related to a VPN via an input unit.

JP 2004-40433 A

  However, since it is necessary to have specialized knowledge in order to input setting information related to VPN, it is difficult for end users such as telecommuting to input the setting information. For this reason, a maintenance staff member went to the site where the VPN connection device was installed, and the maintenance staff member entered setting information. Also, when a network change or connection switching occurs, it is necessary for a maintenance person to visit the site to change the setting of the VPN connection device. As described above, since the setting work related to the VPN connection is complicated, it is required to reduce the setting work.

  The present invention has been made in view of these points, and an object of the present invention is to provide a VPN connection system and a VPN connection method capable of reducing work related to VPN connection.

  A VPN connection system according to a first aspect of the present invention is a VPN connection system comprising a first communication device, a second communication device, and a VPN management server connected to each other via a network, wherein the VPN management system The server includes first setting information used when the first communication device makes a VPN connection to the second communication device, and second setting information used when the second communication device makes a VPN connection to the first communication device. A setting information storage unit for storing; a setting information transmitting unit for transmitting the first setting information to the first communication device and transmitting the second setting information to the second communication device; A first communication device configured to store the first setting information received from the VPN management server; and a first communication unit configured to make a VPN connection with the second communication device based on the first setting information. And have The second communication device has a second setting information storage unit for storing the second setting information received from the VPN management server, and a second connection for VPN connection with the first communication device based on the second setting information. And a communication unit.

  The VPN management server includes a request receiving unit that receives a request to update the first setting information and the second setting information, and a first setting corresponding to the updated first setting information based on the request. A setting information creation unit that creates update information and second setting update information corresponding to the updated second setting information, and the setting information transmission unit includes the setting information creation unit One setting update information may be transmitted to the first communication device, and the second setting update information may be transmitted to the second communication device.

  The first communication device may further include a first storage control unit that updates the first setting information stored in the first setting information storage unit when receiving the first setting update information from the VPN management server. A second storage control for updating the second setting information stored in the second setting information storage unit when receiving the second setting update information from the VPN management server; It may have a part.

  The setting information transmission unit transmits information indicating a date and time for updating the first setting information to the first communication device, and transmits information indicating a date and time for updating the second setting information to the second communication device. You may send it.

  Further, the VPN management server, the first communication device, and the second communication device transmit and receive the first setting information and the second setting information through a first VPN connection session in which setting information is fixed, The first communication device and the second communication device may transmit and receive data through a second VPN connection session set based on the first setting information and the second setting information.

  The setting information storage unit is associated with each of the first communication device and the second communication device, and the first setting information and the second communication device that can be downloaded by the first communication device and the second communication device, respectively. The second setting information may be stored.

  The first communication device further includes an acquisition unit that requests the address of the second communication device from a dynamic DNS server and acquires the address of the second communication device, and the first communication unit acquires You may make a VPN connection with the second communication device based on the address of the second communication device.

  The VPN connection method according to the second aspect of the present invention includes the first communication device, the second communication device, and the VPN management server connected to each other via a network, and the first communication device and the first communication device. A VPN connection method for VPN-connecting two communication devices, wherein the VPN management server uses first setting information used when the first communication device makes a VPN connection to the second communication device to the first communication device. A transmission procedure, a procedure in which the VPN management server transmits second setting information used when the second communication device makes a VPN connection to the first communication device, and the first communication device. On the basis of the first setting information received from the VPN management server, and a procedure for establishing a VPN connection with the second communication device, and the second setting information received from the VPN management server by the second communication device. Based on, and a procedure of the first communication device and the VPN connection.

  According to the present invention, it is possible to reduce work related to VPN connection.

It is a schematic diagram of the VPN connection system which concerns on 1st Embodiment. It is a functional block diagram of the VPN management server which concerns on 1st Embodiment, a 1st communication apparatus, and a 2nd communication apparatus. It is a sequence diagram which shows the flow of the process in the VPN connection system which concerns on 1st Embodiment. It is a functional block diagram of the VPN management server which concerns on 2nd Embodiment, a 1st communication apparatus, and a 2nd communication apparatus. It is a sequence diagram which shows the flow of the process which concerns on the update of the setting information in the VPN connection system which concerns on 2nd Embodiment. It is a functional block diagram of the VPN management server which concerns on 3rd Embodiment, a 1st communication apparatus, and a 2nd communication apparatus. It is a sequence diagram which shows the flow of a process in the VPN connection system which concerns on 3rd Embodiment.

Hereinafter, embodiments of the present invention will be described.
<First Embodiment>
[Outline of VPN connection system S]
FIG. 1 is a schematic diagram of a VPN connection system S according to the first embodiment.
The VPN connection system S includes a VPN management server 1, a first communication device 2, and a second communication device 3, and is used, for example, for VPN connection between an office of a company and a company employee's house. It is done.
The VPN management server 1, the first communication device 2, and the second communication device 3 are connected to be communicable with each other via a network N such as the Internet.

  The first communication device 2 is, for example, a router, and is installed in an office such as a company after initial setting is performed at a control center. The first communication device 2 is communicably connected to a plurality of servers 4 installed in the office.

  The second communication device 3 is, for example, a router, and is installed in an employee's house such as a company after initial setting is performed at a control center. The 2nd communication apparatus 3 is connected so that communication with the terminal 5 installed in the employee's house is possible.

  The VPN management server 1 is installed, for example, in a control center that centrally manages information related to VPN connections. The VPN management server 1 includes first setting information used when the first communication device 2 makes a VPN connection to the second communication device 3, and a second setting used when the second communication device 3 makes a VPN connection to the first communication device 2. Stores setting information. The VPN management server 1 transmits the first setting information to the first communication device 2 and transmits the second setting information to the second communication device 3.

  When the first communication device 2 and the second communication device 3 receive the first setting information or the second setting information from the VPN management server 1, they make a VPN connection based on these setting information. Thereby, for example, the terminal 5 installed in the employee's house can communicate securely with the plurality of servers 4.

  Then, the function with which the VPN management server 1, the 1st communication apparatus 2, and the 2nd communication apparatus 3 are provided is demonstrated. FIG. 2 is a functional configuration diagram of the VPN management server 1, the first communication device 2, and the second communication device 3 according to the first embodiment. In FIG. 2, description will be made with the network N omitted. In the first embodiment, it is assumed that a fixed IP address is assigned to each of the first communication device 2 and the second communication device 3.

[Configuration Example of VPN Management Server 1]
First, the functional configuration of the VPN management server 1 will be described. The VPN management server 1 is a computer and includes a CPU, a storage unit, a communication interface, and the like. The VPN management server 1 includes a setting information registration unit 11, a setting information storage unit 12, and a setting information transmission unit 13.

The setting information registration unit 11 accepts registration of setting information via an input unit (not shown) provided in the VPN management server 1.
Specifically, the setting information registration unit 11 accepts registration of connection information, which is setting information used when the first communication device 2 and the second communication device 3 make a VPN connection to the VPN management server 1. In addition, the setting information registration unit 11 accepts registration of first setting information and second setting information used when the first communication device 2 and the second communication device 3 make a VPN connection.

Specifically, the setting information registration unit 11 includes, for example, identification information (for example, setting name) for identifying each of a plurality of setting information as the setting information setting items, and the IP address of the communication device to which the VPN is connected. Alternatively, the communication device that performs the name and VPN connection accepts input of an authentication key for authenticating each other. In addition, the setting information registration unit 11 receives an encryption algorithm for encrypting data and an authentication algorithm setting for obtaining a hash value of the data.
Here, it is assumed that the setting information (connection information) used when the first communication device 2 and the second communication device 3 make a VPN connection to the VPN management server 1 is fixed information.

  The setting information storage unit 12 stores the first setting information and the second setting information received by the setting information registration unit 11. Specifically, the setting information storage unit 12 associates the first communication device 2 and the second communication with the identification information of each of the first communication device 2 and the second communication device 3 (for example, the IP address of the communication device). Each of the devices 3 stores first setting information and second setting information that can be downloaded.

  The setting information transmission unit 13 transmits the first setting information stored in the setting information storage unit 12 to the first communication device 2, and the second setting information stored in the setting information storage unit 12 is second. Transmit to the communication device 3.

  Specifically, when receiving the access from the first communication device 2 based on the connection information, the setting information transmission unit 13 performs the authentication process of the first communication device 2, and in response to the successful authentication, the VPN connection Establish a session. Here, the VPN connection session performed between the VPN management server 1 and each communication device is referred to as a first VPN connection session. The setting information transmission unit 13 transmits the first setting information to the first communication device 2 through the first VPN connection session.

  In addition, when the setting information transmission unit 13 receives access from the second communication device 3 based on the connection information, the setting information transmission unit 13 performs an authentication process of the second communication device 3 and, in response to successful authentication, the first VPN connection Establish a session. Then, the setting information transmission unit 13 transmits the second setting information to the second communication device 3 through the first VPN connection session.

[Configuration Example of First Communication Device 2]
Next, the functional configuration of the first communication device 2 will be described. The first communication device 2 includes a CPU, a storage unit, a communication interface, and the like. The first communication device 2 includes a first storage unit 21, a first storage control unit 22, and a first communication unit 23.

  The first storage unit 21 stores connection information for establishing a first VPN connection session between the VPN management server 1 and the first communication device 2. The first storage unit 21 functions as a first setting information storage unit and stores the first setting information received from the VPN management server 1.

The first storage control unit 22 accepts registration of connection information at the time of initial setting of the first communication device 2 in the control center, and stores the connection information in the first storage unit 21.
The first storage control unit 22 stores the first setting information received from the VPN management server 1 in the first storage unit 21 after the first communication device 2 is installed in a corporate office.

  Specifically, for example, when the first communication device 2 is installed in the office of a company and powered on, the first storage control unit 22 is based on the connection information stored in the first storage unit 21. A VPN connection request is made to the management server 1. Subsequently, the first storage control unit 22 receives the first setting information from the VPN management server 1 after successful authentication of the first communication device 2 in the VPN management server 1 and establishment of the first VPN connection session. To do. Subsequently, the first storage control unit 22 stores the received first setting information in the first storage unit 21.

  The first communication unit 23 makes a VPN connection with the second communication device 3 based on the first setting information. Specifically, when the first setting information is stored in the first storage unit 21, the first communication unit 23 makes a VPN connection request to the second communication device 3. For example, the VPN connection request includes the authentication key set in the first setting information, and the second communication device 3 performs authentication based on the authentication key. If the authentication is successful in the second communication device 3, the first communication unit 23 can access the terminal 5 via the second communication device 3. Here, the first communication unit 23 may retry the VPN connection request when the authentication based on the VPN connection request is not successful due to the fact that the installation of the second communication device 3 is not completed. .

  Further, the first communication unit 23 receives a VPN connection request from the second communication device 3. This VPN connection request includes the authentication key set in the second setting information, and the first communication unit 23 is based on the authentication key and the authentication key set in the first setting information. Authenticate. When the first communication unit 23 succeeds in the authentication, the first communication unit 23 permits access from the second communication device 3 to the plurality of servers 4.

[Configuration Example of Second Communication Device 3]
Next, the functional configuration of the second communication device 3 will be described. The second communication device 3 includes a CPU, a storage unit, a communication interface, and the like. The second communication device 3 includes a second storage unit 31, a second storage control unit 32, and a second communication unit 33.

  The second storage unit 31 stores connection information for establishing a first VPN connection session between the VPN management server 1 and the second communication device 3. The second storage unit 31 functions as a second setting information storage unit and stores the second setting information received from the VPN management server 1.

The second storage control unit 32 accepts registration of connection information at the time of initial setting of the second communication device 3 in the control center, and stores the connection information in the second storage unit 31.
The second storage control unit 32 stores the second setting information received from the VPN management server 1 in the second storage unit 31 after the second communication device 3 is installed in the employee's house of the company.

  Specifically, for example, the second storage control unit 32 is based on connection information stored in the second storage unit 31 when the second communication device 3 is installed in a company employee's house and turned on. Then, a VPN connection request is made to the VPN management server 1. Subsequently, the second storage control unit 32 receives the second setting information from the VPN management server 1 after successful authentication of the second communication device 3 in the VPN management server 1 and establishment of the first VPN connection session. To do. Subsequently, the second storage control unit 32 stores the received second setting information in the second storage unit 31.

  The second communication unit 33 establishes a VPN connection with the first communication device 2 based on the second setting information. Specifically, when the second setting information is stored in the second storage unit 31, the second communication unit 33 makes a VPN connection request to the first communication device 2. When the first communication device 2 succeeds in the authentication based on the VPN connection request, the second communication unit 33 can access the plurality of servers 4 via the first communication device 2. Here, the second communication unit 33 may retry the VPN connection request when the authentication based on the VPN connection request is not successful due to the fact that the installation of the first communication device 2 is not completed. .

  Further, the second communication unit 33 receives a VPN connection request from the first communication device 2. This VPN connection request includes the authentication key set in the first setting information, and the second communication unit 33 is based on the authentication key and the authentication key set in the second setting information. Authenticate. If the second communication unit 33 succeeds in the authentication, the second communication unit 33 permits access from the first communication device 2 to the terminal 5.

  By allowing bidirectional communication between the first communication device 2 and the second communication device 3, a second VPN connection session is established. Thereafter, the first communication device 2 and the second communication device 3 transmit and receive data through a second VPN connection session set based on the first setting information and the second setting information.

[sequence]
Next, a process flow in the VPN connection system S according to the first embodiment will be described. FIG. 3 is a sequence diagram showing a flow of processing in the VPN connection system S according to the first embodiment.

  First, in the control center, initial setting of the first communication device 2 and the second communication device 3 is performed. Specifically, the first storage control unit 22 of the first communication device 2 accepts registration of connection information in the initial setting, and stores the connection information in the first storage unit 21 (S10). The second storage control unit 32 of the second communication device 3 accepts registration of connection information in the initial setting, and stores the connection information in the second storage unit 31 (S20).

  Subsequently, when the first communication device 2 is installed in the corporate office and the power is turned on, the first storage control unit 22 reads the connection information stored in the first storage unit 21 (S30). A VPN connection request is made to the VPN management server 1 based on the information.

  When receiving the VPN connection request from the first communication device 2, the setting information transmission unit 13 of the VPN management server 1 performs an authentication process (S40). If the authentication is successful (YES in S50), the setting information transmission unit 13 transmits the first setting information stored in the setting information storage unit 12 to the first communication device 2. Upon receiving the first setting information, the first storage control unit 22 stores the first setting information in the first storage unit 21 (S60).

  Similarly, when the second communication device 3 is installed at the employee's house and the power is turned on, the second storage control unit 32 reads the connection information stored in the second storage unit 31 (S70), A VPN connection request is made to the VPN management server 1 based on the information.

  When receiving the VPN connection request from the second communication device 3, the setting information transmission unit 13 of the VPN management server 1 performs an authentication process (S80). When the authentication is successful (YES in S90), the setting information transmission unit 13 transmits the second setting information stored in the setting information storage unit 12 to the second communication device 3. Upon receiving the second setting information, the second storage control unit 32 stores the second setting information in the second storage unit 31 (S100).

  Then, while the 1st communication part 23 of the 1st communication apparatus 2 performs a VPN connection process based on 1st setting information, the 2nd communication part 33 of the 2nd communication apparatus 3 is based on 2nd setting information. VPN connection processing is performed (S110, S120). Specifically, the first communication unit 23 and the second communication unit 33 each perform authentication based on the VPN connection request, and communicate from the second communication device 3 to the plurality of servers 4 in response to successful authentication. And communication from the first communication device 2 to the terminal 5 is permitted.

[Effect in the first embodiment]
As described above, according to the VPN connection system S, the VPN management server 1 transmits the first setting information to the first communication device 2 and transmits the second setting information to the second communication device 3. Then, the first communication device 2 makes a VPN connection with the second communication device 3 based on the first setting information received from the VPN management server 1, and the second communication device 3 receives the second communication device 2 received from the VPN management server 1. Based on the setting information, the first communication device 2 is connected to the VPN. By doing in this way, in the 1st communication apparatus 2 and the 2nd communication apparatus 3, VPN connection can be performed without performing a special operation | work at the time of installation of the 1st communication apparatus 2 and the 2nd communication apparatus 3. Therefore, the VPN connection system S can reduce work related to VPN connection. In the VPN connection system S, since the setting information can be managed on the VPN management server 1 side, maintenance management can be easily performed.

  The VPN management server 1, the first communication device 2, and the second communication device 3 transmit and receive the first setting information and the second setting information through the first VPN connection session in which the setting information is fixed. In this way, the VPN management server 1 can securely transmit and receive the first setting information and the second setting information to the first communication device 2 and the second communication device 3.

<Second Embodiment>
[Update setting information]
Next, the second embodiment will be described. In the second embodiment, for example, the installation location of the first communication device 2 or the second communication device 3 is changed due to moving or a new communication device is added, or the VPN connection is turned on / off. This corresponds to the case to be controlled. In the second embodiment, when the VPN management server 1 receives a request to update the setting information, the setting update information is created and transmitted to the communication device, and the communication device updates the setting information. Unlike the first embodiment, the other points are the same. By doing in this way, the VPN connection system S which concerns on 2nd Embodiment can update a setting remotely, without performing a setting update operation | work in the place where the communication apparatus is installed.

FIG. 4 is a functional configuration diagram of the VPN management server 1, the first communication device 2, and the second communication device 3 according to the second embodiment.
As shown in FIG. 4, the VPN management server 1 according to the second embodiment further includes a request reception unit 14 and a setting information creation unit 15.

  The request receiving unit 14 receives a request for updating the first setting information and the second setting information. Specifically, in the control center, the user of the VPN management server 1 receives an update request for the first setting information and the second setting information from a company that uses the first communication device 2 and the second communication device 3. For example, the user of the VPN management server 1 changes the installation location of the first communication device 2 or the second communication device 3 by moving or the like from the user of the first communication device 2 or the second communication device 3, and a new communication device. Request for updating the first setting information and the second setting information at the time of controlling on / off of the VPN connection between the first communication device 2 and the second communication device 3. Thereafter, the request receiving unit 14 receives an update request for at least one of the first setting information and the second setting information from the user of the VPN management server 1 via the input unit.

  Based on the request to update the setting information, the setting information creation unit 15 obtains the first setting update information corresponding to the updated first setting information and the second setting update information corresponding to the updated second setting information. create. For example, the setting information creation unit 15 creates information that is changed from the first setting information before the update as the first setting update information based on a request to update the first setting information. Similarly, the setting information creation unit 15 creates, as the second setting update information, information that is changed from the second setting information before the update, based on the request for updating the second setting information.

  Note that the setting information creation unit 15 may create new first setting information as the first setting update information based on a request to update the first setting information. Similarly, the setting information creation unit 15 may create new second setting information as the second setting update information.

The setting information transmission unit 13 transmits the first setting update information created by the setting information creation unit 15 to the first communication device 2 and transmits the second setting update information to the second communication device 3.
The setting information transmission unit 13 transmits information indicating the date and time when the first setting information is updated to the first communication device 2, and transmits information indicating the date and time when the second setting information is updated to the second communication device 3. May be. By doing in this way, the VPN connection system S can change setting information corresponding to the installation change schedule of the 1st communication apparatus 2 and the 2nd communication apparatus 3. FIG.

When receiving the first setting update information from the VPN management server 1, the first storage control unit 22 of the first communication device 2 updates the first setting information stored in the first storage unit 21. For example, when the first setting update information is information that is changed from the first setting information before the update, the first storage control unit 22 updates the first setting information based on the information. In addition, when the first setting update information is newly created first setting information, the first storage control unit 22 newly sets the first setting information stored in the first storage unit 21. Replace with the created first setting information. Note that the first storage control unit 22 may periodically access the VPN management server 1 and determine whether or not the first setting information has been updated.
When the first storage control unit 22 receives information indicating the date and time when the first setting information is updated from the VPN management server 1, the first storage control unit 22 sets the first setting information according to the current date and time. Update.

When the second storage control unit 32 of the second communication device 3 receives the second setting update information from the VPN management server 1, the second storage control unit 32 stores the second storage control unit 32 in the second storage unit 31 by the same process as the first storage control unit 22. 2. Update the setting information. Note that the second storage control unit 32 may periodically access the VPN management server 1 and determine whether or not the second setting information has been updated.
When the second storage control unit 32 receives information indicating the date and time when the second setting information is updated from the VPN management server 1, the second storage control unit 32 sets the second setting information according to the current date and time. Update.

[sequence]
Next, the flow of processing related to the update of setting information in the VPN connection system S according to the second embodiment will be described. FIG. 5 is a sequence showing a flow of processing related to the update of the setting information in the VPN connection system S according to the second embodiment.

First, in the control center, the request receiving unit 14 receives a request to update the first setting information and the second setting information (S200).
Subsequently, the setting information creation unit 15 creates setting update information based on a request to update the setting information (S210). The setting information creation unit 15 creates the first setting update information when the request for updating the setting information corresponds to the first setting information, and the second when the request for updating the setting information corresponds to the second setting information. Create configuration update information.

Subsequently, the setting information transmission unit 13 determines whether or not the setting update information corresponds to the first setting information (S220). The setting information transmission unit 13 transmits the first setting update information to the first communication device 2 when it is determined that the setting update information corresponds to the first setting information (when the determination is YES).
When receiving the first setting update information from the VPN management server 1, the first storage control unit 22 of the first communication device 2 updates the first setting information stored in the first storage unit 21 (S230).

Subsequently, the setting information transmission unit 13 determines whether the setting update information corresponds to the second setting information (S240). The setting information transmission unit 13 transmits the second setting update information to the second communication device 3 when it is determined that the setting update information corresponds to the second setting information (when the determination is YES).
When the second storage control unit 32 of the second communication device 3 receives the second setting update information from the VPN management server 1, the second storage control unit 32 updates the second setting information stored in the second storage unit 31 (S250).

[Effects of Second Embodiment]
As described above, according to the VPN connection system S, the first storage control unit 22 updates the first setting information when receiving the first setting update information from the VPN management server 1, and the second storage control unit 32 When the second setting update information is received from the management server 1, the second setting information is updated. By doing in this way, the VPN connection system S according to the second embodiment allows the VPN management server 1 to perform setting update work in a place where the first communication device 2 and the second communication device 3 are installed. The first setting information and the second setting information can be updated remotely.

  In the VPN connection system S according to the second embodiment, since the setting information is updated on the VPN management server 1 side, for example, by setting the VPN on / off in the setting information, the VPN on / off can be controlled. Switching can be performed on the VPN management server 1 side.

<Third Embodiment>
[VPN connection is made based on the address of the second communication device 3 acquired from the dynamic DNS server 4]
Subsequently, a third embodiment will be described. The third embodiment is different from the first embodiment in that the IP address of the second communication device 3 is dynamically assigned. The VPN connection system S according to the third embodiment further includes a dynamic DNS server 4 that manages an IP address dynamically assigned to the communication device and a host name of the communication device, and includes the first communication. The apparatus 2 is different from the first embodiment in that the apparatus 2 acquires the IP address of the second communication apparatus 3 from the dynamic DNS server 4 and performs VPN connection based on the IP address.

FIG. 6 is a functional configuration diagram of the VPN management server 1, the first communication device 2, and the second communication device 3 according to the third embodiment.
In the third embodiment, the first communication device 2 further includes an acquisition unit 24.
The acquisition unit 24 requests the dynamic DNS server 4 for the IP address of the second communication device 3 and acquires the IP address of the second communication device 3.

  Specifically, the name of the second communication device 3 that is the VPN connection destination is stored in the first setting information in the third embodiment. Here, the name of the second communication device 3 includes, for example, a combination of a domain name indicating a company and a device name of the second communication device 3. When the VPN connection with the second communication device 3 is not established, the acquisition unit 24 periodically requests the dynamic DNS server 4 to acquire an IP address. Here, the IP address acquisition request includes the name of the second communication device 3 set in the first setting information.

When the dynamic DNS server 4 receives an IP address acquisition request, the dynamic DNS server 4 acquires an IP address corresponding to the name of the second communication device 3 included in the acquisition request and transmits the IP address to the first communication device 2. The acquisition unit 24 updates the first setting information based on the acquired IP address.
The first communication unit 23 accesses the second communication device 3 based on the acquired IP address of the second communication device 3 and performs VPN connection with the second communication device 3.

[sequence]
Next, the flow of processing in the VPN connection system S according to the third embodiment will be described. FIG. 7 is a sequence showing a flow of processing in the VPN connection system S according to the third embodiment.

The second communication device 3 transmits the device name of the second communication device 3 and the IP address to the dynamic DNS (DDNS) server 4 in response to the assignment of the IP address. The dynamic DNS server 4 registers the IP address of the second communication device 3 by storing the IP address in association with the device name of the second communication device 3 (S5).
The processing from S10 to S70 is the same as the processing from S10 to S70 in the sequence diagram described in FIG.

When the first setting information is stored in the first storage unit 21, the acquisition unit 24 requests the dynamic DNS server 4 to acquire the IP address of the second communication device 3. When the dynamic DNS server 4 receives the IP address acquisition request, the dynamic DNS server 4 acquires an IP address corresponding to the name of the second communication device 3 included in the acquisition request (S62), and transmits the IP address to the first communication device 2. . The acquisition unit 24 updates the first setting information based on the acquired IP address (S64).
The processing from S80 to S120 is the same as the processing from S80 to S120 in the sequence diagram described in FIG.

[Effect in the third embodiment]
As described above, according to the VPN connection system S according to the third embodiment, the first communication device 2 is connected to the second communication device 3 based on the IP address of the second communication device 3 acquired from the dynamic DNS server 4. Make a VPN connection. Therefore, even if the IP address of the second communication device 3 is dynamically assigned, the VPN connection system S can perform the VPN connection without any trouble.

  As mentioned above, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the range as described in the said embodiment. It will be apparent to those skilled in the art that the above-described embodiments can be combined and various modifications or improvements can be added to the above-described embodiments.

  For example, in the above-described embodiment, the VPN connection between the first communication device 2 and the second communication device 3 has been described. However, the VPN connection may be performed in three or more communication devices. In this case, the setting information registration unit 11 receives the IP addresses or names of the plurality of communication devices that perform VPN connection with the one communication device in the registration of the setting information, and each of the plurality of communication devices Accepts authentication key, encryption algorithm, and authentication algorithm settings. And each communication apparatus memorize | stores the setting information used when making a VPN connection to another communication apparatus, and shall perform a VPN connection based on the said setting information.

DESCRIPTION OF SYMBOLS 1 ... VPN management server, 11 ... Setting information registration part, 12 ... Setting information storage part, 13 ... Setting information transmission part, 14 ... Request reception part, 15 ... Setting information creation , 2... First communication device, 21... First storage unit, 22... First storage control unit, 23... First communication unit, 3. ..Second storage unit, 32 ... second storage control unit, 33 ... second communication unit, 4 ... dynamic DNS server, N ... network, S ... VPN connection system

Claims (8)

A VPN connection system comprising a first communication device, a second communication device, and a VPN management server connected to each other via a network,
The VPN management server
Settings for storing first setting information used when the first communication device makes a VPN connection to the second communication device and second setting information used when the second communication device makes a VPN connection to the first communication device An information storage unit;
A setting information transmitting unit that transmits the first setting information to the first communication device and transmits the second setting information to the second communication device;
The first communication device is
A first setting information storage unit for storing the first setting information received from the VPN management server;
Based on the first setting information, the first communication unit having a VPN connection with the second communication device,
The second communication device is
A second setting information storage unit for storing the second setting information received from the VPN management server;
Based on the second setting information, the second communication unit having a VPN connection with the first communication device,
VPN connection system. The VPN management server
A request receiving unit that receives a request to update the first setting information and the second setting information;
A setting information creation unit for creating first setting update information corresponding to the updated first setting information and second setting update information corresponding to the updated second setting information based on the request; Have
The setting information transmission unit transmits the first setting update information created by the setting information creation unit to the first communication device, and transmits the second setting update information to the second communication device.
The VPN connection system according to claim 1. The first communication device further includes a first storage control unit that updates the first setting information stored in the first setting information storage unit when receiving the first setting update information from the VPN management server. And
The second communication device further includes a second storage control unit that updates the second setting information stored in the second setting information storage unit when receiving the second setting update information from the VPN management server. ,
The VPN connection system according to claim 2. The setting information transmission unit transmits information indicating a date and time when the first setting information is updated to the first communication device, and transmits information indicating a date and time when the second setting information is updated to the second communication device. ,
The VPN connection system according to claim 2 or 3. The VPN management server, the first communication device, and the second communication device transmit and receive the first setting information and the second setting information through a first VPN connection session in which setting information is fixed,
The first communication device and the second communication device transmit and receive data through a second VPN connection session set based on the first setting information and the second setting information.
The VPN connection system of any one of Claim 1 to 4. The setting information storage unit is associated with each of the first communication device and the second communication device, and the first setting information and the second setting information that can be downloaded by each of the first communication device and the second communication device. Memorize the setting information,
The VPN connection system of any one of Claim 1 to 5. The first communication device further includes an acquisition unit that requests a dynamic DNS server for the address of the second communication device and acquires the address of the second communication device;
The first communication unit makes a VPN connection with the second communication device based on the acquired address of the second communication device.
The VPN connection system of any one of Claim 1 to 6. A VPN connection method for VPN connection between the first communication device and the second communication device using a first communication device, a second communication device, and a VPN management server connected to each other via a network. ,
A procedure in which the VPN management server transmits first setting information used when the first communication device makes a VPN connection to the second communication device to the first communication device;
A procedure in which the VPN management server transmits second setting information used when the second communication device establishes a VPN connection to the first communication device to the second communication device;
The first communication device makes a VPN connection with the second communication device based on the first setting information received from the VPN management server;
The second communication device makes a VPN connection with the first communication device based on the second setting information received from the VPN management server;
VPN connection method comprising:

Images